Logstash-安裝logstash-filter-multiline插件(解決logstash匹配多行日誌)

ELK-logstash在搬運日誌的時候會出現多行日誌，普通的搬運會形成保存到ES中日誌一條一條的保存，很醜，並且不方便讀取，logstash-filter-multiline能夠解決該問題。

接下來演示下問題：
普通日誌以下：

2018-08-31 15:04:41.375 [http-nio-18081-exec-1] ERROR c.h.h.control.**-自定義的msg java.lang.ArithmeticException: / by zero at com.hikvision.hikserviceassign.control.ServiceMonitorManageController.reAssign(ServiceMonitorManageController.java:170) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:497) at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205) .....省略

 

記錄到es的記錄則是：

2018-08-31 15:04:41.375 [http-nio-18081-exec-1] ERROR c.h.h.control.**-自定義的msg 2018-08-31 15:04:41.375 [http-nio-18081-exec-1]java.lang.ArithmeticException: / by zero 2018-08-31 15:04:41.375 [http-nio-18081-exec-1]at com.hikvision.hikserviceassign.control.ServiceMonitorManageController.reAssign(ServiceMonitorManageController.java:170) 2018-08-31 15:04:41.375 [http-nio-18081-exec-1]at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 2018-08-31 15:04:41.375 [http-nio-18081-exec-1]at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 2018-08-31 15:04:41.375 [http-nio-18081-exec-1]at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 2018-08-31 15:04:41.375 [http-nio-18081-exec-1]at java.lang.reflect.Method.invoke(Method.java:497) 2018-08-31 15:04:41.375 [http-nio-18081-exec-1]at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205) .....省略

咱們但願的結果確定是這樣的

接下來就是安裝logstash-filter-multiline，進入logstash/bin目錄下使用命令

$ ./logstash-plugin install logstash-filter-multiline

若是報錯 certificate verify failed 則在install 後面加上 --no-verify

安裝成功後，增長config，demo以下：

input { tcp { port => 4560 codec => json } } filter { multiline { pattern => "^\d{4}-\d{1,2}-\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}" negate => true what => "previous" } }  output { elasticsearch { hosts => "127.0.0.1:9200" index => "es-message-%{+YYYY.MM.dd}" } stdout { codec => rubydebug } }